Dandelion Online Teaching System frontend ex*** routing file has SQL injection vulnerability

Dandelion Online Teaching System is the website of Shenzhen Tomorrow See Technology Co., Ltd, which is an innovative science and technology enterprise focusing on the research and development of videoconferencing, video teaching and telemedicine system. Dandelion Online Teaching System has a SQL...

GitLab CE/EE Information Disclosure Vulnerability (CNVD-2018-26955)

GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository, which has similar functionality to Github for accessing the contents of a project's files, commit history, bug lists, and more. An information...

Quora Gets Hacked – 100 Million Users Data Stolen

The World's most popular question-and-answer website Quora has suffered a massive data breach with unknown hackers gaining unauthorized access to potentially sensitive personal information of about 100 million of its users. Quora announced the incident late Monday after its team last Friday...

Joomla! Component JE Photo Gallery 1.1 - categoryid SQL Injection

Joomla! Component JE Photo Gallery 1.1 - categoryid SQL Injection Exploit Title: Joomla! Component JE Photo Gallery 1.1 - SQL Injection Dork: N/A Date: 2018-11-26 Exploit Author: Ihsan Sencan Vendor Homepage: https://joomlaextensions.co.in Software Link:...

Parallel Override Vulnerability in SDCMS v1.6

SDCMS era website information management system is a product of Suzhou Fireworks Network Technology Co., Ltd. to asp + access for the development of the portal system. SDCMS v1.6 has a parallel override vulnerability. Attackers can use the vulnerability to illegally modify the user release...

razorCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-26701)

razorCMS is an open source content management system written in PHP, which stores all data in flat files, so there is no need to install a database. A cross-site request forgery vulnerability exists in the rars/user/data page in razorCMS version 3.4.8. A remote attacker can exploit this...

Get the message: Your shopper data is trying to tell you something

This article originally appeared in Internet Retailer As we head into the thick of the holiday shopping season, web teams must make sure the path from discovery to purchase is as easy and painless as possible. Knowing where potential fail points are ahead of time makes it easier to prepare, while...

BBC: MiSafes’ child-tracking smartwatches are ‘easy to hack’

Following our research on the MiSafes kids tracking watch we spoke to the BBC's Rory Cellan-Jones and Leo Kelion about the risks, and what consumers can do. We found that the devices didn't encrypt user data, and that each child's account wasn't secured. The result is that children's movements...

Traffic bank app has information leakage vulnerability

Traffic Bank App is a traffic management and trading platform software. Traffic Bank APP has information leakage vulnerability. Attackers tamper with packets by grabbing packets to obtain other users' information...

EZSA-2018-007 User data disclosure

More info at http://share.ez.no/community-project/security-advisories/ezsa-2018-007-user-data-disclosure...

Vulnerability in the "My Orders" section of the Eastern Presentation Society App

East Presentation Club APP is a convenient hotel booking platform. An override access vulnerability exists in the "My Order" section of Dongcheng Club APP. An attacker can traverse the key fields to obtain sensitive information of other users through packet capture...

Yaddo Hotel App Has Override Access Vulnerability

Yaddo Hotel APP is a hotel booking service software. A vulnerability exists in Yaddo Hotel APP for override access. An attacker traverses the chainId field by grabbing packets to obtain sensitive information about other users...

PT-2018-13649

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository Manager versions prior to 3.14 Description The issue allows for cross-site scripting XSS, which is a type of attack where an attacker injects malicious code into a website, potentially stealing user data or taking...

Eastern Presentation Society APP has information leakage vulnerability

East Presentation Club APP is a hotel booking platform. An information disclosure vulnerability exists in the Dongcheng Club APP. It allows attackers to utilize a packet grabber tool to traverse the Key field to obtain sensitive information about other users...

Galaxy Forces MMORPG 0.5.8 - 'type' SQL Injection

Exploit Title: Galaxy Forces MMORPG 0.5.8 - 'type' SQL Injection Dork: N/A Date: 2018-11-14 Exploit Author: Ihsan Sencan Vendor Homepage: http://galaxy.alyx.pl/ Software Link: https://excellmedia.dl.sourceforge.net/project/galaxyforces/galaxy/0.5.8/galaxy-0.5.8.7z Version: 0.5.8 Category: Webapps...

The evolution of Microsoft Threat Protection, November update

At Ignite 2018, we announced Microsoft Threat Protection, a comprehensive, integrated solution securing the modern workplace across identities, endpoints, user data, cloud apps, and, infrastructure Figure 1. The foundation of the solution is the Microsoft Intelligent Security Graph, which...

Patched Facebook Vulnerability Could Have Exposed Private Information About You and Your Friends

In a previous blog we highlighted a vulnerability in Chrome that allowed bad actors to steal Facebook users’ personal information; and, while digging around for bugs, thought it prudent to see if there were any more loopholes that bad actors might be able to exploit. What popped up was a bug that...

Overstepping Access Vulnerability in Rattle Car Rental App

Rattle Rental App is a car rental app. There is an overstepping access vulnerability in Ringer Rental Car APP. Attackers can use the vulnerability to capture packets to obtain sensitive information of other users...

A DJI Bug Exposed Drone Photos and User Data

Researchers found that they could compromise DJI's single sign-on tokens, similar to the issue behind Facebook's massive breach this September...

CCTV News App Has Override Access Vulnerability

CCTV News App is a portal news app software. CCTV News APP has an override access vulnerability . Attackers can use this vulnerability to directly query other users' information by grabbing packets and modifying UID parameters...